Cyber Insurance FAQ

Get answers to the most common questions about cyber insurance for small and mid-size businesses.


What is cyber insurance?

Cyber insurance (also called cyber liability insurance) is a specialized policy that protects businesses against financial losses from cyber incidents like data breaches, ransomware attacks, business email compromise, and network intrusions.

It typically covers:

  • First-party costs: Your direct losses (forensics, recovery, business interruption)
  • Third-party liability: Lawsuits from affected customers or partners

Learn more in our Cyber Insurance Buying Guide


How much does cyber insurance cost?

Small businesses typically pay $500 to $5,000 annually, depending on:

FactorImpact on Premium
IndustryHealthcare/Finance pay 2-3x more
RevenueHigher revenue = higher premium
Security postureStrong controls can reduce premium 15-25%
Coverage limits$1M vs $5M affects cost significantly
Claims historyPrior incidents increase rates

A typical $1M/$2M policy for a small business averages $1,500-$2,500/year.

See detailed pricing data in Cyber Insurance Cost 2025


What does cyber insurance cover?

Most policies include:

Data breach response — Forensics, notifications, credit monitoring
Ransomware — Payment (if elected) and recovery costs
Business interruption — Lost income during downtime
Legal defense — Regulatory investigations and lawsuits
Crisis management — PR and reputation repair
Social engineering fraud — BEC and wire fraud (often sublimited)
Third-party liability — Customer lawsuits for exposed data


What is NOT covered?

Common exclusions:

❌ Acts of war / nation-state attacks
❌ Pre-existing vulnerabilities you knew about
❌ Intentional acts by employees
❌ Bodily injury and property damage
❌ Failure to maintain promised security controls
❌ Some policies exclude cryptocurrency losses

Read about claim denials and how to avoid them


Is cyber insurance required by law?

Not in most states, but it’s often required by:

  • Business contracts with enterprise clients
  • Industry regulations (healthcare, finance)
  • Vendor agreements when handling sensitive data
  • Loan covenants and M&A due diligence

Check requirements by state


Do I need cyber insurance if I have general liability?

Yes. General liability specifically excludes cyber incidents. It covers bodily injury and property damage—not data breaches, ransomware, or network failures.

Some BOP policies include basic cyber endorsements with very low limits ($50K-$100K). For meaningful protection, standalone cyber insurance is recommended.

Compare: Cyber vs General Liability


What security controls do insurers require?

Most carriers now mandate:

  1. Multi-factor authentication (MFA) on email and remote access
  2. Endpoint detection and response (EDR)
  3. Regular, tested backups (offline/immutable preferred)
  4. Security awareness training for employees
  5. Patch management within 30-90 days

Premium carriers may also require privileged access management and 24/7 SOC monitoring.

Full security checklist


How long does it take to get a quote?

  • Simple risks: Minutes through online platforms
  • Complex risks (healthcare, finance, tech): 2-4 weeks

The application typically asks about your security controls, IT infrastructure, data handling, and incident history.

Get quotes from multiple carriers


What happens when I file a claim?

  1. Call the 24/7 breach hotline immediately
  2. Insurer assigns a breach coach (attorney) to coordinate
  3. Forensic investigators assess the damage
  4. Legal counsel handles notifications and regulators
  5. PR team manages communications if needed

Most insurers have pre-approved vendor panels for faster response.

Understanding the claims process


Can claims be denied?

Yes. Common reasons:

  • Misrepresentation on the application
  • Failure to maintain promised security controls
  • Late notice of the incident
  • Incident before the retroactive date
  • War exclusion triggered
  • Known vulnerabilities not patched

Being honest on your application and maintaining your security posture are critical.

Real denial case studies


Still have questions?